using the Resource Kit with the free license

[oogabooga]

I'm trying to connect to Splunk via the Resource Kit and it gives me an unauthorized error.

This worked great with the Enterprise License trial, but now I can't connect even with the admin ID and password.

Invoke-HTTPPost : Exception calling "GetResponse" with "0" argument(s): "The remote server returned an error: (401) Unauthorized."

What gives? I've heard from several different sources that if you have less than 500mb per day, this is a great way to track your logs. I'd like to send my logs to Splunk with the resource kit. Specifically Write-SplunkMessage cmdlet.

Is there a special way for me to connect with the free license using the Resource Kit?

Thanks in advance for your help.

[oogabooga]

gpduck saved the day. Here are the details:

http://www.oogabooga.info/2012/10/splunk-powershell-and-free-license.html

Thanks again everybody who helped out.

[ChrisG]

Copying in this info from Twitter @bsonposh (might be an exchange with you, actually, but putting it in here for others to see):

The problem is that most of the cmdlets assume authentication. Try -noauth on invoke-splunkrestapi

• -noauth switch seems to work, but Write-SplunkMessge had auth wrapped all around it and other functions that it calls. 😞

I know… We need to fix that in the next release 😞

[oogabooga]

ha, that was me. I'm posting the workaround in the next thread below.

[ChrisG]

I don't know much about the PowerShell Resource Kit, but Splunk free does not have authentication or access control--no login. See More About Splunk Free in the Admin Manual.

[oogabooga]

Yeah, I don't care about auth. I just want to send it logs to keep track of what my scripts are doing. I'm working around the issue now by sending syslog, but I'd like to use the Resource Kit if possible.